Proof-of-concept exploit code is public for two Android kernel flaws, CVE-2026-43284 and CVE-2026-43499. GovCERT.HK, the Hong Kong government's computer emergency team, reported this in an alert dated 4 November 2026.
What the sources say
Google's Android Security Bulletin for November 2026, published on 2 November, lists both flaws under the 2026-11-01 patch level. It rates both High and classes them as elevation of privilege in the kernel. The GovCERT.HK alert says the available code demonstrates denial of service. The two descriptions differ, and neither source reports attacks.
Which phones are affected
GovCERT.HK names Android 14, 15, 16 and 17. Whether a particular phone is protected depends on its maker and model, because the fix reaches each phone through that maker's own update. GovCERT.HK advises checking with the phone's maker whether a patch is available.
What to do
Open Settings and find the security update date. The location varies by brand and is usually under About phone or Software information. Google states that a patch level of 2026-11-05 or later covers every issue in the bulletin. If the date is older, install any pending system update. Phones that no longer get security updates will not receive the fix through the normal update route.
In Pakistan
No report of attacks in Pakistan appears in the sources read. Software update support differs by brand, so it is worth checking before buying. The compare tool puts two phones side by side. An earlier Android issue, a message that can crash the phone's calling service, is covered in Android flaw lets a message crash your phone.